AVD - Android Virtual Device
Last updated
Last updated
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Thank you very much to @offsecjay for his help while creating this content.
Android Studio allows to run virtual machines of Android that you can use to test APKs. In order to use them you will need:
The Android SDK tools - Download here.
Or Android Studio (with Android SDK tools) - Download here.
In Windows (in my case) after installing Android Studio I had the SDK Tools installed in: C:\Users\<UserName>\AppData\Local\Android\Sdk\tools
In mac you can download the SDK tools and have them in the PATH running:
Or from Android Studio GUI as indicated in https://stackoverflow.com/questions/46402772/failed-to-install-android-sdk-java-lang-noclassdeffounderror-javax-xml-bind-a which will install them in ~/Library/Android/sdk/cmdline-tools/latest/bin/ and ~/Library/Android/sdk/platform-tools/ and ~/Library/Android/sdk/emulator/
For the Java problems:
If you installed Android Studio, you can just open the main project view and access: Tools --> AVD Manager.
Then, click on Create Virtual Device
select the phone you want to use and click on Next.
If you need a phone with Play Store installed select one with the Play Store icon on it!
In the current view you are going to be able to select and download the Android image that the phone is going to run:
So, select it and if it isn't downloaded click on the Download symbol next to the name (now wait until the image is downloaded).
Once the image is downloaded, just select Next and Finish.
The virtual machine will be created. Now every time that you access AVD manager it will be present.
In order to run it just press the Start button.
First of all you need to decide which phone you want to use, in order to see the list of possible phones execute:
Once you have decide the name of the device you want to use, you need to decide which Android image you want to run in this device.
You can list all the options using sdkmanager:
And download the one (or all) you want to use with:
Once you have downloaded the Android image you want to use you can list all the downloaded Android images with:
At this moment you have decided the device you want to use and you have downloaded the Android image, so you can create the virtual machine using:
In the last command I created a VM named "AVD9" using the device "Nexus 5X" and the Android image "system-images;android-28;google_apis;x86_64". Now you can list the virtual machines you have created with:
We have already seen how you can list the created virtual machines, but you can also list them using:
You can simply run any virtual machine created using:
Or using more advance options you can run a virtual machine like:
However there are a lot of different command line useful options that you can use to initiate a virtual machine. Below you can find some interesting options but can find a complete list here
Boot
-snapshot name : Start VM snapshot
-snapshot-list -snapstorage ~/.android/avd/Nexus_5X_API_23.avd/snapshots-test.img : List all the snapshots recorded
Network
-dns-server 192.0.2.0, 192.0.2.255 : Allow to indicate comma separated the DNS servers to the VM.
-http-proxy 192.168.1.12:8080 : Allow to indicate an HTTP proxy to use (very useful to capture the traffic using Burp)
-port 5556 : Set the TCP port number that's used for the console and adb.
-ports 5556,5559 : Set the TCP ports used for the console and adb.
-tcpdump /path/dumpfile.cap : Capture all the traffic in a file
System
-selinux {disabled|permissive} : Set the Security-Enhanced Linux security module to either disabled or permissive mode on a Linux operating system.
-timezone Europe/Paris : Set the timezone for the virtual device
-screen {touch(default)|multi-touch|o-touch} : Set emulated touch screen mode.
-writable-system : Use this option to have a writable system image during your emulation session. You will need also to run adb root; adb remount. This is very useful to install a new certificate in the system.
If you downloaded a device with Play Store you are not going to be able to get root directly, and you will get this error message
Using rootAVD with Magisk I was able to root it (follow for example this video or this one).
Check the following page to learn how to install a custom CA cert:
Install Burp CertificateYou can use the GUI to take a snapshot of the VM at any time:
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
